REMARKS/ARGUMENTS 

This paper is being provided in response to the June 8, 2005 Office Action for the above- 
referenced application. In this response, Applicant has amended Claims 121 and 142, and added 
new Claims 175-176 in order to clarify that which Applicant deems to be the claimed invention. 
Applicant respectfully submits that the amendments to the claims are all supported by the 
originally filed application. 

In response to the objection to the title, Applicant has amended the title herein. 
Accordingly, Applicant respectfully requests that the object be reconsidered and withdrawn. 

The rejection of Claims 121-127, 129-133, 141-148, 150-154 and 162-166 under 35 
U.S.C. 103(a) as being unpatentable over Kronenberg, et al., (U.S. Patent Application 
Publication No. 2004/0030778, hereinafter "Kronenberg") is hereby traversed and 
reconsideration thereof is respectfully requested. Applicant respectfully submits that Claims 
121-127, 129-133, 141-148, 150-154 and 162-166, as amended herein, are patentable over the 
cited reference. 

Applicant's Claim 121, as amended herein, recites a method for monitoring an industrial 

network comprising: reporting first data about a first computer system by a first agent executing 

on said first computer system in said industrial network, said first computer system performing at 

least one of: monitoring or controlling a physical process of said industrial network, said first 

data including information about software used in connection with said physical process, 

wherein said agent sends said first data over a one way communication connection. Claims 122- 

127, 129-133, 141, 163 and 164 depend from Claim 121. 
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Applicant's Claim 142, as amended herein, recites a computer program product for 
monitoring an industrial network comprising code that: reports first data about a first computer 
system by a first agent executing on said first computer system in said industrial network, said 
first computer system performing at least one of: monitoring or controlling a physical process of 
said industrial network, said first data including information about software used in connection 
with said physical process, wherein said agent sends said first data over a one way 
communication connection. Claims 143-148, 150-154, 162, 165, and 166 depend from Claim 
142. 

Kronenberg discloses a data processing system with an RMS server 104, and a CAS 
server 106 located at NOS 102. RMS server 104 may monitor the status of the RMS server at 
the client site 120. Figure 1 also includes one or more devices. (Par. 45; Figure 1). Figure 2 A 
includes checker software 226 that monitors a device and communicates with informer engine 
222 to receive additional information regarding the device and interfaces with agents located 
within various devices. (Par. 47; Figure 2A). Figure 2B depicts more detail of CAS server 106. 
Included in 106 is a secondary storage device 256 containing an expert rules database 263 which 
is used to determine potential courses of action once tickets are received. (Par. 52; Figure 2B). 
The RMS server sends information regarding the non-responding service or network traffic 
report to the NOS as a ticket. (Par. 39). RMS server 122 may communicate with agent 326 by 
sending commands to checker software 226 that communicates with agent 326. RMS server 
may communicate with checker software 226 (which in turn communicates with agent 326). For 
example, checker software 226 may transmit commands to start and/or stop agent 326. Also, 
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checker software 226 may transmit information to agent 326 to update the agent, modify the 
agent's behavior, or delete the agent. (Par. 102). 

Applicant's Claim 121, as amended herein, is neither disclosed nor suggested by 
Kronenberg in that Kronenberg neither discloses nor suggests a method for monitoring an 
industrial network comprising: reporting first data about a first computer system by a first 
agent ... said first data including information about software used in connection with said 
physical process, wherein said agent sends said first data over a one way communication 
connection, as set forth in Claim 121. Kronenberg discloses using agents on devices and using 
checker software included in an RMS server. The checker software on the RMS server issues 
commands to the agent, and information is also reported by the agent to the RMS server. Thus, 
Kronenberg' s agent does not use a one-way communication connection, as set forth in amended 
Claim 121. 

The Office Action at page 3 states that Kronenberg does not explicitly teach reporting 

information about software used in connection with a physical process of the industrial network 

but states that such reporting would have been obvious. Applicant respectfully submits that 

Kronenberg appears to neither disclose nor suggest such reporting and also neither discloses nor 

suggests reporting of such data being performed by an agent, as also recited in Applicant's Claim 

121. Kronenberg discloses monitoring network services, environmental conditions, security 

services, unauthorized devices, and network traffic (Par. 37, 39, 73). Kronenberg discloses that 

the agent may be a CPU monitor program (Par. 101). However, Kronenberg appears silent 

regarding any disclosure or suggestion of monitoring software used in connection with a physical 

process of the industrial network. Furthermore, Applicant respectfully submits that Kronenberg 
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appears silent regarding having an agent perform report the data about the software. Applicant 
respectfully submits that disclosure in Kronenberg of monitoring a service, and listing particular 
services as described above, neither discloses nor suggests monitoring all kinds of software, and 
also neither discloses nor suggests monitoring the particular software as recited in Claim 121. 

Applicant respectfully submits that claims that depend from Claim 121 are neither 
disclosed nor suggested by Kronenberg for at least those reasons set forth above regarding Claim 
121. However, Kronenberg also neither discloses nor suggests features set forth in claims that 
depend from Claim 121. 

The Office Action at page 3 states that Kronenberg discloses features set forth in 
dependent Claims 125-127 and cites par. 38 of Kronenberg as support. Par. 38 of Kronenberg 
states that agents may be associated with a device being monitored. Par. 102 of Kronenberg also 
states that checker software controls operation of the agent on the device. In connection with 
Applicant's Claims 125 and 126, Applicant respectfully submits that the foregoing neither 
discloses nor suggests a plurality of agents executing on the first computer system to monitor the 
first computer system, as recited in Claim 125, and the plurality of agents including a master 
agent and other agents where the master agent controls execution of the other agents, as recited 
in Claim 126. Rather, Kronenberg teaches controlling execution of the agents on the device 
using checker software executing on the RMS server rather than the device. Applicant 
respectfully submits that Par. 102 of Kronenberg teaches away from the features of Claim 125 
and 126 by controlling the agent using checker software not on the same system. 
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The Office Action on pages 3-4 states that Kronenberg discloses features set forth in 
dependent Claims 129-131 and cites as support par. 109 and that it would have been obvious to 
implement any security rules on the monitored ports. Par. 109 discloses making a determination 
regarding a hypothesis and accordingly determining if an anomaly and/or problem exists. 
Applicant's Claims 130 and 131 recite particular determinations in accordance with a number of 
open listen connections. Applicant's Claim 130 recites wherein, when a number of open listen 
connections falls below a first level, an event corresponding to a component failure is 
determined, and Claim 131 recites wherein, when a number of open listen connections is above 
a second level, an event corresponding to a new component or unauthorized component is 
determined. Applicant respectfully submits that Kronenberg appears silent regarding any 
disclosure or suggestion of the specific determinations as recited in Claims 130 and 131 
regarding the number of open listen connections. Furthermore, a general disclosure as set forth in 
Kronenberg does not render obvious all such determinations, including those as recited in Claims 
130-131. 

The Office Action on page 4 states that Kronenberg discloses the features recited in 

Claims 132-33 and cites as support par. 52. Par. 52 discloses an expert rule database used to 

determine potential courses of action once tickets are received. Applicant's Claim 132 recites 

wherein said second agent reports on network activity in accordance with a set of rules, said 

rules including at least one rule indicating that events in a business network are flagged as 

suspicious in said industrial network. Applicant respectfully submits that Claim 132 recites 

features regarding what an agent reports, rather than processing of the report once received from 

the agetn, as in the foregoing disclosure of Kronenberg. The foregoing recited portion of 

Kronenberg operates on the tickets once received rather than in connection with creating or 
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generating a ticket. Accordingly, Kronenberg neither discloses nor suggests the feature set forth 
in Claims 132-133. 

The Office Action at page 4 states that Kronenberg discloses the features of Claim 141 
which recites wherein said reporting is performed in accordance with a threshold size indicates 
an amount of data that said first agent is permitted to transmit in a fixed periodic reporting 
interval As support for disclosing the foregoing features of Claim 141, par 78 of Kronenberg is 
cited. Par. 78 of Kronenberg discloses processing that occurs when the deliverer software is 
transmitting a ticket to the CAS server and trying various delivery methods in the event failure is 
detected for certain ones. Confirmation is expected from the CAS server and if not received in a 
predetermined period of time, a failed delivery attempt is indicated and a different method is 
tried. Par. 78 of Kronenberg appears silent regarding any disclosure or suggestion of reporting in 
accordance with a threshold size or fixed reporting interval. Rather, the foregoing par. 78 
discloses processing when no confirmation of a ticket transmission is received. Applicant 
respectfully submits that Kronenberg neither discloses nor suggests the features of Claim 141, or 
any rule regarding reporting. 

For reasons similar to those set forth regarding Claim 121, Applicant's amended Claim 
142 is also neither disclosed nor suggested by Kronenberg in that Kronenberg neither discloses 
nor suggests a computer program product for monitoring an industrial network comprising 
code that: reports first data about a first computer system by a first agent ... said first data 
including information about software used in connection with said physical process, wherein 
said agent sends said first data over a one way communication connection, as set forth in 
Claim 142. 
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In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

The rejection of Claims 128, 134-40, 149, and 155-161 under 35 U.S.C. 103(a) as being 
unpatentable over Kronenberg and further in view of Schlossberg (U.S. Patent Publication No. 
2002/00660034, hereinafter "Schlossberg") is is hereby traversed and reconsideration thereof is 
respectfully requested. Applicant respectfully submits that Claims 128, 134-40, 149, and 155- 
161 are patentable over the cited references. 

Claims 128 and 134-140 depend from Claim 121, and Claims 149, 155-161 depend from 
Claim 142. For reasons set forth above, independent Claims 121 and 142, and all claims that 
depend therefrom, are neither disclosed nor suggested by Kronenberg. For reasons set forth 
below, Applicant respectfully submits that combining Kronenberg with Schlossberg also neither 
discloses nor suggests Claims 121 and 142, and claims that depend therefrom. 

The Office Action on page 4 cites Schlossberg as support for disclosing a network 
security system for detecting and handling network attacks. 

Applicant's Claim 121, as amended herein, is neither disclosed nor suggested by the 
references, taken separately or in combination, in that the references neither disclose nor suggest 
a method for monitoring an industrial network comprising: reporting first data about a first 
computer system by a first agent . . . said first data including information about software used 

in connection with said physical process, wherein said agent sends said first data over a one 
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way communication connection, as set forth in Claim 121 . For at least the reasons set forth 
above, Kronenberg neither discloses nor suggests at least the foregoing recited features of Claim 
121. Schlossberg appears silent regarding any disclosure or suggestion of the foregoing features 
of Claim 121. Thus, combining Kronenberg with Schlossberg does not overcome the 
deficiencies of Kronenberg with respect to Claim 121. Accordingly, the references neither 
disclose nor suggest Claim 121. 

For reasons similar to those set forth regarding Claim 121, Applicant's Claim 142 is also 
neither disclosed nor suggested by the references, taken separately or in combination, in that the 
references neither disclose nor suggest a computer program product for monitoring an 
industrial network comprising code that: reports first data about a first computer system by a 
first agent ... said first data including information about software used in connection with 
said physical process, wherein said agent sends said first data over a one way communication 
connection, as set forth in Claim 142. 

Applicant respectfully submits that newly added Claims 175 and 176 are also patentable 
over the cited art. 
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Based on the above, Applicant respectfully requests that the Examiner reconsider and 
withdraw all outstanding rejections and objections. Favorable consideration and allowance are 
earnestly solicited. Should there be any questions after reviewing this paper, the Examiner is 
invited to contact the undersigned at 508-898-8604. 



Muirhead and Saturnelli, LLC 
200 Friberg Parkway, Suite 1001 
Westborough, MA 01581 
Tel: (508) 898-8601 
Fax: (508) 898-8602 

Date: December 7. 2005 




Anne E. Saturnelli 



Reg. No. 41,290 
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